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Good morning Chairman Levin, Ranking Member Coburn, and members of the 
Subcommittee. My name is David Bagley. Thank you for the opportunity to be here today. 

Since 2002, 1 have been the Head of Group Compliance at HSBC Holdings pic - which is 
the global parent of HSBC. I joined Midland Bank in 1992 and, later that year, after HSBC 
acquired Midland, I began work for HSBC in its Head Office in London, where I work today. 
Over the years, I have served in various positions in HSBC offices around the world. 

Having been a compliance officer for 13 years in a bank that operates in approximately 
80 jurisdictions worldwide, I have dedicated my career - not only within HSBC but through my 
broader industry work as well - to meeting the sometimes significant challenges that confront 
global banking institutions in the world we live in. As this Subcommittee well knows, these 
challenges include money laundering by narcotics traffickers and terrorist financing, to name just 
a few. I have followed the work of this Subcommittee and have seen how your work has 
advanced important dialogues and helped the international banking community, including 
HSBC, identify and address potential vulnerabilities. 

My chief focus as the Head of Group Compliance at HSBC has been promoting the 
values that we as a bank have set for ourselves and the values that you and our regulators, both in 
the United States and around the world, rightly expect from a global bank like HSBC. And, 
while there have been successes on many compliance issues, I recognize that there have been 
some significant areas of failure. I have said before and I will say again: despite the best efforts 
and intentions of many dedicated professionals, HSBC has fallen short of our own expectations 
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and the expectations of our regulators. At the same time, this is something that a bank seeking to 
conduct business in the United States and globally must acknowledge, address, learn from, and, 
most importantly, take steps to avoid in the future. 

I know my time today is limited and there are a number of topics to discuss. Let me 
touch on some of them briefly. 

First, we have learned a number of valuable lessons, and the bank is well along the way 
of converting those lessons into solutions. One of these lessons concerns managing growth. 
With the benefit of hindsight, it is now clear to many of us that the bank's business and risk 
profile grew faster than its infrastructure. We have learned that implementing the kinds of robust 
policies and practices expected of a global banking leader can take longer than anticipated. The 
bank underestimated some of the challenges presented by its numerous acquisitions, and despite 
efforts to meet these challenges, we were not always able to keep up. While many people at 
HSBC worked diligently to get it right, the bank simply must do better. 

How can we get it right? Let me touch briefly on a few of these changes. 

As I expect my colleague Stuart Levey to describe in some detail, HSBC is in the process 
of shedding the historical compliance model that the bank has outgrown. This departure from 
the old model is transformative. Our former compliance structure was a product of historical 
growth by acquisition and it was a major factor behind some of the issues that I expect we will 
be discussing today. 

Under the former structure, the bank's Group Compliance function based in London 
mirrored HSBC's overall global corporate structure - which is an international federation of 
affiliates around the globe. Many of these affiliates began as relatively small independent banks 
that HSBC acquired over the years with increasing frequency. As the bank's footprint grew 
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through these acquisitions, HSBC's structure evolved into one with a small corporate center, on 
the one hand, and numerous affiliates around the world operating with a significant degree of 
autonomy and varying levels of direct interaction among those affiliates, on the other. 

Under the former model, the role of Group Compliance was an advisory one: we 
promulgated the baseline standards that all of the bank's affiliates were expected to follow. As 
the Head of Group Compliance, my mandate was limited to advising, recommending, and 
reporting. My job was not - and I did not have the authority, resources, support, or infrastructure 
- to ensure that all of these global affiliates followed the Group's compliance standards. Rather, 
final authority and decision-making rested with local line management in each of the bank's 
affiliates. 

This model worked for many years. But over time, HSBC's growth accelerated rapidly. 
Some of the new acquisitions had operations that at the time of acquisition fell far short of 
HSBC's own compliance standards and expectations and were in relatively lightly regulated but 
often high risk jurisdictions. At the same time, increased terrorism and narco-trafficking, and 
other financial sector developments, exposed the international banking system to new 
vulnerabilities and greater challenges. In addition, regulatory expectations both in the United 
States and abroad rightly continued to increase. With its roots in a far smaller bank in a very 
different global banking environment, HSBC's historic model, in retrospect, simply did not keep 
pace. Now, a major overhaul is underway. 

The new compliance model is a product of deep reflection and is tailored to address 
today's challenges as well as the inevitable challenges of tomorrow. Let me mention a few 
significant differences between the bank's prior compliance model and the new model. 
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First, the bank's Group Compliance function now, for the first time, has authority over 
the compliance departments at every one of the bank's affiliates. The new model empowers 
Group Compliance to adopt and implement consistent compliance standards across the Group 
and to assess each of the bank's affiliates through a dedicated Assurance team so that the Group 
can have confidence that its affiliates are following and enforcing these standards. This is a stark 
break from the past. Now, Group Compliance has both the mandate and the resources to ensure 
that affiliates are compliant. In other words, now for the first time, Group Compliance is an 
advisory and a control function and personnel at the affiliates are now accountable to Group 
Compliance for their conduct. 

Second, the CEO of each affiliate previously controlled the allocation of resources and 
compensation associated with that affiliate's compliance function. That has changed as well. 
Under the new model, Group Compliance oversees the bank's nearly 3,500 compliance officers 
worldwide and takes the lead on decisions about resource allocation, compensation, performance 
review, objectives, strategy, budget, and accountability across all of our worldwide compliance 
departments. This gives Group Compliance far more control over and understanding of the 
bank's global compliance efforts. 

Third, HSBC has made significant enhancements to the resources at the Group 
Compliance level. In 2002, when I took on the role of Head of Group Compliance, we had a 
staff of only eight people. Now we have close to 40 people working in Group Compliance in 
London, and that figure continues to grow. 

Fourth, the bank has adopted new robust diligence policies. Historically, unless required 
by the local jurisdiction, the bank did not mandate that HSBC affiliates perform due diligence on 
other HSBC affiliates. However, we now require affiliates to perform diligence on each other. 
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And, we are in the process of rolling out the enhanced Know-Your-Customer program at our 
U.S. bank on a global scale. This is a substantial task because HSBC has approximately 100 
million customer relationships worldwide. Nevertheless, it is an important one. It will enable 
the bank to make more informed and responsible decisions about its customers. 

While I will not touch on all of the recent enhancements to our model, I do want to 
elaborate on one of these changes, the creation of a dedicated Assurance team. The mission of 
this new function is both to review the effectiveness of our compliance functions at all levels 
around the globe and to escalate compliance issues that need remediation. This team is charged 
with ensuring that our compliance efforts around the world meet Group standards, conducting 
proper monitoring, and meeting the expectations of their regulators. The team is also charged 
with ensuring that compliance issues are properly escalated to the Group level, that the business 
and compliance functions are working together to manage risk effectively and responsibly, and 
that every compliance team has the required skills and appropriate resources. This function, 
which is in addition to the continuing role of Group Audit in conducting audits of affiliates 
worldwide, has already provided substantial benefits. 

In conclusion, the authority of the Head of Group Compliance and therefore the function 
as a whole is greatly increased. We have split from the legal function and now form a part of a 
substantially empowered risk function. This will require affiliates to act on advice and 
recommendations quickly and effectively. 

* * * 

Despite the best intentions and efforts of so many dedicated compliance and business 
professionals, HSBC has in some important areas failed to meet our expectations and the 
expectations of our regulators. I am happy, however, to be able to say that the bank has learned 
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from its past and is already on a path to becoming a better, stronger banking institution. The 
bank's structure is, in short, very different from what it was in 2002, when I agreed to serve as 
Head of Group Compliance. 

Thank you for your time. I welcome this opportunity to answer any questions. 
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